Privacy and security

Your mail is yours

mssgs mail runs on our own mail server in Europe. Below is how that works, in plain words: where your mail lives, what happens to an incoming message and why a sender cannot tell that you read it.

Hosted in EUOwn mail serverDKIM, SPF and DMARCGDPR

Where your mail lives

On our own machines in the Netherlands. Not at an American provider, and not in a region that happens to sit outside the EU.

Our own hardware

The mail server, the storage and the attachments sit on our own host in the Netherlands.

Inside the EU

Your messages, your attachments and your address list do not leave the European Union.

A Dutch company

mssgs mail is a product of Deverence Group B.V., based in the Netherlands and bound by the GDPR.

Gone is gone

What you throw away stays in Trash for thirty days and is then really deleted, attachments included.

Our own mail server

There is no third-party mail platform in between. Mail for mssgsmail.com arrives at our own Exim and leaves through it as well.

Unknown recipients never get in

While a message is still being offered, the mail server checks whether the address exists. If it does not, the message is refused there and then rather than quietly swallowed.

Encrypted on the way

Connections to the web client and between our own parts run over TLS. To other mail servers we use TLS wherever the other side offers it.

The original is kept

For every message that arrives we keep the untouched original, so an argument about what was actually sent can be settled.

A short log

For the mail flow we keep fourteen days of who offered what and what happened to it. After that the line expires by itself.

Signed and checked

Mail is only trustworthy when the sender can be verified. That runs both ways, and we do both.

DKIM on what you send

Every message you send is signed by our mail server, so the recipient can tell it was not changed along the way.

SPF

The DNS of mssgsmail.com says which servers may send on our behalf. Everything else should be refused.

DMARC

The policy tells other servers what to do with a message that does not add up. While we ramp up that is quarantine, and after that reject.

And on the way in

For incoming mail we keep what the checks concluded, per message, so the client can show you whether a sender is who they claim to be.

Spam

We filter with a score and with your own rules. In that order: your rule beats the score.

A score

The mail server judges every incoming message and gives it a number.

Your threshold

You decide from which number a message goes to Spam. The default sits where ordinary mail does not end up there.

Your rules

A sender you marked as spam goes straight there from then on, and a sender you pulled out of Spam arrives normally.

Nothing disappears

Spam goes to a folder, not to the bin. You look in it whenever you want.

What we take out of a message

A formatted mail is a stranger's web page. Before you see it, we take out what does not belong in it.

No scripts

Scripts, event attributes on elements and javascript: links are removed before the message is stored.

No embedded pages or forms

A message cannot load another page and cannot show a form that sends your details somewhere.

Remote images stay off

Until you show them, the sender does not know whether, when or how often you opened their message. That is exactly what a tracking pixel is trying to measure.

Remembered per sender

Choose once to always show images from someone and you never have to do it again for that sender.

Your account

Signing in runs on the same account system mssgs uses. Your session is yours and expires by itself.

Two-factor

Turn on two-factor with an authenticator app and signing in asks for a six-digit code alongside your password.

Sessions expire

Your access runs out and renews quietly while you are using it. Signing out invalidates it immediately.

Only your mail

Every message, every draft and every attachment belongs to an owner. No request lets the client claim whose something is.

Limits against abuse

Sending, signing up and signing in have limits per hour and per day. You will never notice them, a spammer will.

What we do not do

The short list, so you do not have to infer it from what is here.

No ads

Nowhere in the client, and never between your messages.

No profiles

We do not read your mail to work out what kind of person you are.

No reselling

Your data does not go to advertisers, data brokers or anyone else.

No trackers on this site

This website loads no third-party fonts, scripts or pixels. There is not a single analytics cookie.

Found something?

Report it and we will pick it up. We answer every report and keep you posted until it is fixed.

A security problem

Send it to support@mssgsmail.com with enough detail to reproduce it. Please hold publication until it is fixed.

Abuse or spam from us

Mail from an mssgsmail.com address that should never have existed belongs at abuse@mssgsmail.com, ideally with the full headers.

Delivery problems

Run another mail server and something is not arriving? postmaster@mssgsmail.com is read by a person.

mssgs mail is in beta. That does not mean we take this less seriously, it means things will still turn up. Report them.

Mail that stays yours

Free while in beta. One address, 5 GB, no ads.

Get your address FAQ